Methods and apparatus of an immutable threat intelligence system

1. An apparatus, comprising: a processor configured to convert network intelligence data into at least one data structure, the processor configured to store the at least one data structure in a data store, the processor configured to calculate an identity value for each of the at least one data structure so as to generate a first set of identity values, the at least one data structure being immutable such that data represented in the at least one data structure is not modified, the identity value for each of the at least one data structure being a cryptographic hash value derived from at least one attribute of the at least one data structure; and a query engine implemented by the processor and configured to receive a request for intelligence status data, the query engine configured to query an index data store for a second set of identity values correlated with data included in the request, the index data store storing each identity value from the first set of identity values calculated for each of the at least one data structure, the query engine configured to retrieve, from the data store, intelligence status data correlated with each identity value in the second set of identity values, the query engine configured to return a snapshot data structure representing at least a portion of the intelligence status data correlated with each identity value in the second set of identity values, in response to the request.

2. The apparatus of claim 1 , wherein: the intelligence status data is first intelligence status data; the processor is configured to receive second intelligence status data, the processor configured to generate a set of data structures based on the second intelligence status data, the set of data structures being new immutable versions of the at least one data structure, the processor is configured to calculate an identity value for each data structure from the set of data structures, each identity value for each data structure from the set of data structures matching an identity value in the first set of identity values.

3. The apparatus of claim 1 , wherein the snapshot data structure includes references to a plurality of data structures including the at least one data structure, the plurality of data structures being generated within a predetermined period of time defined by a start of a first time and a termination of the first time.

4. The apparatus of claim 1 , wherein the intelligence status data includes data from a most recently defined data structure that has been generated from the network intelligence data.

5. The apparatus of claim 1 , wherein: the query engine is configured to coalesce the intelligence status data to produce coalesced intelligence status data, when more than one data structure is included in the intelligence status data, the portion of the intelligence status data, correlated with each identity value in the second set of identity values, being the coalesced intelligence status data; and the query engine is configured to include the coalesced intelligence status data in the snapshot data structure when returning the snapshot data structure.

6. An apparatus, comprising: a processor configured to convert intelligence input into a set of immutable data structures, the processor configured to generate an identity value for each immutable data structure from the set of immutable data structures, each identity value being a cryptographic hash value derived from at least one attribute of the associated immutable data structure, the processor configured to query a data store using an identity value of an immutable data structure from the set of immutable data structures and the processor configured to store at least one immutable data structure from the set of immutable data structures in an immutable data structure data store when the associated identity value is not found in the data store, the processor configured to store a copy of the associated identity value in the data store; and a query engine operatively coupled to the processor and configured to receive a request for network intelligence data, the query engine configured to retrieve a portion of immutable data structures stored in the immutable data structure data store based on the request, the query engine configured to generate an intelligence timeline based on data from each immutable data structure from the portion of immutable data structures, the query engine configured to render a graphical representation of the intelligence timeline in a graphical interface, the intelligence timeline representing known states of network elements associated with each immutable data structure from the portion of immutable data structures.

7. The apparatus of claim 6 , wherein the at least one attribute of the immutable data structure distinguishes the immutable data structure from other immutable data structures in the set of immutable data structures.

8. The apparatus of claim 6 , wherein the data store stores a plurality of identity values associated with a plurality of immutable data structures including the set of immutable data structures.

9. The apparatus of claim 6 , wherein: the immutable data structure is a first immutable data structure, the data store stores a plurality of identity values associated with a plurality of immutable data structures including the set of immutable data structures, and the processor configured to query the data store so as to determine whether a second immutable data structure is already stored at the immutable data structure data store.

10. The apparatus of claim 6 , wherein the immutable data structure data store is separate and remote from the data store.

11. The apparatus of claim 6 , wherein the data store stores a representation of network intelligence data stored at the immutable data structure data store.

12. The apparatus of claim 6 , wherein: each immutable data structure from the set of immutable data structures includes a plurality of subkeys, such that querying the immutable data structure data store for a subkey from the plurality of subkeys returns an immutable data structure from the set of immutable data structures that is associated with that subkey, and each subkey from the plurality of subkeys is associated with a secondary index, such that a range of possible immutable data structures from the set of immutable data structures can be retrieved based on the secondary index.

13. A method, comprising: receiving network intelligence data; translating the network intelligence data into a set of immutable data structures; storing each immutable data structure in the set of immutable data structures in an immutable data structure data store; calculating an identity value for each immutable data structure from the set of immutable data structures, the identity value for each immutable data structure from the set of immutable data structures being a cryptographic hash value derived from at least one attribute of an associated immutable data structure from the set of immutable data structures; generating a snapshot data structure including a set of identifiers, each identifier in the set of identifiers being associated with an immutable data structure in the set of immutable data structures; receiving a request for the network intelligence data; generating a network intelligence data timeline based on data included in the snapshot data structure; and sending a signal to cause rendering of a graphical representation of the network intelligence data timeline in an interface.

14. The method of claim 13 , wherein each immutable data structure in the set of immutable data structures includes a timestamp, the method further comprising: deleting an immutable data structure in the set of immutable data structures from the immutable data structure data store when an age of the immutable data structure is higher than a predetermined threshold, the age of the immutable data structure being based on the timestamp of the immutable data structure.

15. The method of claim 13 , wherein the network intelligence data is first network intelligence data, the set of immutable data structures is a first set of immutable data structures, the snapshot data structure is a first snapshot data structure, the first snapshot data structure being generated at a first time; the method further comprising: receiving second network intelligence data; translating the second network intelligence data into a second set of immutable data structures; storing each immutable data structure in the second set of immutable data structures in the immutable data structure data store; generating, at a second time after the first time, a second snapshot data structure including a set of identifiers being associated with an immutable data structure in the second set of immutable data structures.

16. The method of claim 13 , wherein the snapshot data structure is a first snapshot data structure generated at a first time, the method further comprises: generating a second snapshot data structure at a second time after the first time, the second snapshot data structure including a set of identifiers each being associated with a second set of immutable data structures stored after the first time, the second snapshot data structure being generated when a number of immutable data structures in the second set of immutable data structures exceeds a predetermined threshold.

17. The method of claim 13 , wherein the immutable data structure data store is a first immutable data structure data store; the method further comprising: syncing the first immutable data structure data store with a second immutable data structure data store separate from the first immutable data structure data store so as to store a copy of the set of immutable data structures at the second immutable data structure data store.